Behavior-oriented inside network security situation modeling and analysis

Cheng ZHU; Jia-jia MIAO; Han-dong MAO

doi:10.11959/j.issn.2096-109x.2016.00067

您当前的位置：

首页 >

文章列表页 >

Behavior-oriented inside network security situation modeling and analysis

Academic paper | 更新时间：2024-06-03

- Behavior-oriented inside network security situation modeling and analysis
- Journal of network and information security Vol. 2, Issue 8, Pages: 17-22(2016)
- 作者机构：
  
  1. 国防科学技术大学信息系统工程重点实验室，湖南长沙410073
  2. 解放军理工大学指挥信息系统学院，江苏南京210007
  3. 北京普世时代科技有限公司，北京 100083
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2016.00067
  CLC： TP393
- Online First：2016-08，
  
  Published：15 August 2016
- 稿件说明：
移动端阅览
Cheng ZHU, Jia-jia MIAO, Han-dong MAO. Behavior-oriented inside network security situation modeling and analysis[J]. Journal of network and information security, 2016, 2(8): 17-22.
DOI：

Cheng ZHU, Jia-jia MIAO, Han-dong MAO. Behavior-oriented inside network security situation modeling and analysis[J]. Journal of network and information security, 2016, 2(8): 17-22. DOI： 10.11959/j.issn.2096-109x.2016.00067.

摘要

依据态势的一般理论，结合内网安全的特点，将内网空间划分为物理域、信息域、社会域，提出了面向行为的内网安全态势——PMDV 模型。该模型抽象出内网空间物理域和信息域中人（P）、机（M）、数据（D）、虚拟实体（V）等4类行为主体，各类主体及其交互定义态势中的核心要素——行为，为面向行为的内网空间安全态势构建提供了依据。在此基础上，进一步给出了面向行为的内网空间安全态势分析平台的结构设计及其实现途径。

Abstract

According to the situation awareness theory as well as the characteristics of the inside network security

a PMDV model for behavior-oriented inside network security situation modeling by dividing the inside network space into physical domain

information domain and social domain was proposed.A sound base for situation modeling of inside network security

which classified the entities inside the network space into the following 4 classes:person(P)

machine(M)

data(D) and virtual agent(V)

was provided and the core element “behavior” in situation model with the interactions between different PMDV entities was defined.The structure and implementation guideline of the situation analysis platform based on PMDV model were also presented and studied.

关键词

Keywords

references

IBM security.IBM 2015 cyber security intelligence index [R ] . IBM , 2015 .

CARDENAS A A , MANADHATA P K , RAJAN S . Big data analytics for security [J ] . IEEE Security＆Privacy , 2013 , ( 11/12 ): 74 - 76 .

RORY W , BETSY B , PARK Y , et al BeyondCorp:a new approach to enterprise security[J].Login , 2014 , 39 ( 6 ): 6 - 11 .

JAY J . Data driven security:analysis,visualization and dashboards [M ] . Indianapolis:John Wiley and Sons , 2014 .

Splunk Inc . Using splunk user behavior analytics [R ] . Splunk , 2015 .

启明星辰 . 基于大数据分析的安全管理平台技术研究及应用 [EB/OL ] . http://www.venustech.com.cn/NewsInfo/531/25566.Html http://www.venustech.com.cn/NewsInfo/531/25566.Html . 2014 .

Venustech . Study and application of information security manage-ment platform based on big data [EB/OL ] . http://www.venustech.com.cn/NewsInfo/531/25566.Html http://www.venustech.com.cn/NewsInfo/531/25566.Html . 2014 .

瀚思 . 数据驱动安全 [EB/OL ] . http://www.hansight.com/Han-Sight_Intro_2015V2.pdf http://www.hansight.com/Han-Sight_Intro_2015V2.pdf . 2015 .

Hansight . Data driven security [EB/OL ] . http://www.hansight.com/HanSight_Intro_2015V2.pdf http://www.hansight.com/HanSight_Intro_2015V2.pdf . 2015 .

张焕国，韩文报，来学嘉，等 . 网络空间安全综述 [J ] . 中国科学， 2016 , 46 ( 2 ): 125 - 164 .

ZHANG H G , HAN W B , LAI X J . Survey on cyberspace secu-rity [J ] . Science China , 2016 , 46 ( 2 ): 125 - 164

ENDSLEY M R . Toward a theory of situation awareness in dy-namic systems [J ] . Human Factors , 1995 , 37 ( 1 ): 32 - 64 .

尤马彦 . 网络安全态势评估技术的研究与实现 [D ] , 广东工业大学 , 2012 .

YOU M Y . Research and implementation of network security situa-tion assessment technology [D ] . Guangzhou:Guangdong University of Technology , 2012 .

王志平 . 基于指标的网络安全态势评估研究 [D ] . 国防科学技术大学 , 2010 .

WANG Z P . Network security situation assessment research based on the index [D ] . Changsha:National University of Defense Tech-nology , 2010 .

杨光 , 马建刚 , 于爱民 , 等 . 内部威胁检测研究 [J ] , 信息安全学报 , 2016 , 1 ( 3 ): 21 - 36 .

YNAG G , MA J G , YU A M , et al . The internal threat detection study [J ] . Journal of Information Security , 2016 , 1 ( 3 ): 21 - 36 .

NURSE J R C , BUCKLEY O , LEGG P A , et al . Under-standing insider threat:a framework for characterising attacks [C ] // IEEE Symposium on Workshop on Research for Insider Threat , IEEE Computer Society Security＆Privacy . c2014 : 215 - 228 .

AZARIA A , RICHARDSON A , KRAUS S , et al . Behavioral analy-sis of insider threat:a survey and boot-strapped prediction in im-balanced data [J ] . IEEE Transactions on Computational Social Sys-tems , 2014 , 1 ( 2 ): 135 - 155 .

JAKOBSON G , BUFORD J , LEWIS L . A framework of cognitive situation modeling and recognition [C ] // 2006 IEEE Military Com-munications Conference . c2006 : 1 - 7 .

Elastic search site [EB/OL ] . https://www.elastic.co/ https://www.elastic.co/ .

Kafka site [EB/OL ] . http://kafka.apache.org/ http://kafka.apache.org/ .

CATTELL R . Scalable SQL and NoSQL data stores [J ] . Sigmod Rec , 2011 , 39 ( 4 ): 12 - 27 .

HDF site [EB/OL ] . https://hadoop.apache.org/docs/r1.2.1/hdfs_design.html https://hadoop.apache.org/docs/r1.2.1/hdfs_design.html .

HIVE site [EB/OL ] . https://hive.apache.org/ https://hive.apache.org/ .

Spark site [EB/OL ] . http://spark.apache.org/ http://spark.apache.org/ .

ZAHARIA M , CHOWDHURY M , DAS T , et al . Resilient distrib-uted datasets:a fault-tolerant abstraction for in-memory cluster computing [C ] // The 9th USENIX Conference on Networked Sys-tems Design and Implementation . c2012 .

Views

2390

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Unmanned aerial vehicle system security cyber range construction and attack-defense validation design

Research of public infrastructure system and security policy in cyberspace

Research on security defense of mobile edge computing

Introduction to cyberspace security discipline

Overview of mobile communication network authentication

Related Author

Li Dongfen

Zhou Rang

Wang Zibin

Duo Bin

Zhang Hui

Li Yujia

Zhiyang WANG

Zhifeng WEI

Related Institution

College of Computer and Network Security, Chengdu University of Technology

Beijing Key Laboratory of Information System Security Technology

China Internet Network Information Center

China Engineering Group Corporation LTD.

School of Science and Technology of Cyberspace,Wuhan University

⁰